История коммитов

Both current-user services are shared and taken in the constructor of hundreds of
controllers and services, so they cannot be rebuilt per request — their state is
replaced instead. The Eloquent user is rehydrated (raw attributes, exists, relations
dropped), the legacy one through the new setProperties(), which restores the declared
properties to their default and removes the dynamic ones left by the previous visitor.

CurrentUserAuthenticator drives it and is idempotent per request object: under FPM the
boot and the kernel serve the same Request, so the second call issues no extra queries.
The boot calls it before resolving the translator, which reads the locale of the profile.

The constant belongs to the process: Ads::checkAccess() and Counters::counters() read
it with defined(), so under a long-running runtime the first home page served would have
made every later page look like the home page. HomepageController now marks the request
itself and both readers take the flag from the RequestStack.

Shared services that need the current request captured it at construction, which makes
them answer with a stale request for every request but the first in a process. They now
read it off Symfony's RequestStack: the bootstrap pushes the request it builds from the
globals, the kernel pushes the request of each cycle and pops it in a finally block.

- Environment no longer resolves the request through di() nor writes the request-rate log
from its constructor: recording a visit was a side effect of resolving the service.
The write is now logRequestRate(), called once per cycle by the kernel. Its unit test
no longer needs newInstanceWithoutConstructor().
- Services caching something request-scoped implement ResetInterface and are collected by
the johncms.resettable tag; the kernel clears them before serving. Environment and
NavChain implement it — three requests in one process now yield two breadcrumbs each
instead of two, three and four.
- $page and $start are gone from the bootstrap: every caller overwrote them. Resolving the
current user stays, it authenticates the visitor and runs the ban check.
- Render is deliberately not reset: its factory adds template globals once at build time,
so clearing the data alone breaks every template. It is fixed together with the rewrite
of that class, which also blocks the worker runtime. Recorded in the plan.

Johncms\Comments took its sub-action and page offset through $mod and $start globals,
which the four calling controllers set right before constructing it. Both are now keys of
the parameter array Comments already accepts, and the class casts the offset itself — it is
interpolated into a LIMIT clause, so that safety used to rest on all four callers
remembering to cast.

- The same controllers read $_REQUEST['page'] and $_GET['start'] directly; they now read
the request. A page number arriving in the body no longer counts, only the query string.
- $GLOBALS['old'], the "new file" threshold of the downloads module, is gone: FilePresenter
derives it from FilePresenter::NEW_FILE_PERIOD. This fixes the mark on eight of the ten
pages using the presenter — only two set the global, everywhere else the fallback of 0
made every file new.
- CommentsPageTest covers the four pages as far as the harness allows: they sit behind
preconditions a guest cannot satisfy, so it asserts they never answer 5xx and checks the
full page only when the stand serves one.

Comments pointed at .claude/http-kernel-migration-plan.md and its stage numbers, which
say nothing once the plan is gone. Rewritten to describe the code itself: "a worker
runtime" instead of "stage 6", "until the request scope is explicit" instead of
"until stage 5".

The session facade now wraps Symfony\Component\HttpFoundation\Session instead of
reading and writing the root of $_SESSION. Session data of existing installs stops
being readable, so every visitor is logged out once — noted in CHANGELOG.md together
with the loss of dot notation in the facade API.

- SessionFactory picks the storage by runtime: native under HTTP, in-memory under
CONSOLE_MODE, so cron runs and console commands no longer open a real PHP session
and leave sess_* files behind. The service is registered explicitly in
system/config/services.php instead of being autowired from a default argument.
- The session is started explicitly in the web bootstrap, before anything reads a key:
a read starts it implicitly, and the translator factory reads 'lng' during boot.
Kernel::handle() keeps an idempotent start() as the per-request entry point.
- Csrf keeps its tokens in one nested array: the facade stores flat keys.
- Session::invalidate() added and used on logout — clear() kept the old session id valid.
- Tests drive the session through its API on in-memory storage.

Replace remaining direct \ usage in modules with Johncms\Http\Session so data access stays unified before the 4b backend swap.

This avoids split storage risk during SessionInterface migration and updates the HTTP kernel migration plan to reflect 4a completion.

3 files: SettingsController ($_SESSION['lng'] → set(), set_ok/reset_ok → flash()), EditProfileController (success_message → flash()), RestorePasswordController ($_SESSION['code'] → set/remove).

IndexController.php and DownloadCategoryController.php: $_SESSION['sort_down'] / $_SESSION['sort_down2'] → $this->session->get(..., 0) / $this->session->set(), lazy init via default argument dropped.

Collections (4 admin controllers): $_SESSION['success_message'] → $this->session->flash()/getFlash(), removed pullFlash() helper.

System (4 files):
- Comments.php: $_SESSION['code'] → $this->session->set/get, fixed $owner type (bool→int) for isBlockedBy()
- TranslatorServiceFactory.php: $_SESSION['lng'] → $session->set/get/has, injected via $container
- Validator/Rules/Captcha.php: $_SESSION[$this->sessionField] → $session->has/get via di()
- Security/Csrf.php: $_SESSION['_csrf'][$token_id] → $this->session->set/get, constructor injection